Skip to content

Commit c0da15d

Browse files
umbynosmarqdevx
andauthored
Apply suggestions from code review
Co-authored-by: Pablo Marquínez Ferrándiz <pablomarqfer@gmail.com>
1 parent efcc9a5 commit c0da15d

File tree

1 file changed

+5
-6
lines changed
  • content/hardware/04.pro/boards/portenta-h7/tutorials/secure-boot

1 file changed

+5
-6
lines changed

content/hardware/04.pro/boards/portenta-h7/tutorials/secure-boot/secure-boot.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ software:
1212
- ide-v2
1313
- cli
1414
---
15-
1615
## Introduction
1716
This short tutorial will guide the user through enabling the secure boot on the Portenta H7, generating custom security keys, and using them with the MCUboot bootloader.
1817

@@ -25,7 +24,7 @@ This short tutorial will guide the user through enabling the secure boot on the
2524
## Instructions
2625

2726
### Flashing the Latest Bootloader
28-
In order to have secure boot enabled you must update the bootloader on your Portenta H7 and use [MCUboot](https://www.mcuboot.com/). You can find more info on how to perform the update in [this other tutorial](../por-ard-bl/content.md).
27+
In order to have secure boot enabled you must update the bootloader on your Portenta H7 and use [MCUboot](https://www.mcuboot.com/). You can find more info on how to perform the update in [this other tutorial](https://docs.arduino.cc/tutorials/portenta-h7/updating-the-bootloader).
2928

3029
### Use Default Security Keys
3130
Once The bootloader has been updated to MCUboot, it's possible to use [secure boot](https://www.keyfactor.com/blog/what-is-secure-boot-its-where-iot-security-starts/) to have an additional layer of security. From that point on it is required to upload a compiled sketch with the Custom Board Option **"Security settings"** set to **"Signature + Encryption"** (the option can be found under **Tools > Security settings** in the IDE when selecting Portenta H7 as board, or you can use `--board-options security=sien` if using the Arduino CLI). Failing to provide such option will cause the bootloader not to run the compiled sketch because it is not trusted.
@@ -37,16 +36,16 @@ These keys are embedded in the example sketch `STM32H747_updateBootloader` which
3736
The default keys provided with the mbed platform are obviously only intended for development purposes. In a production environment it is strongly recommended to generate a new key pair (public and private key).
3837
This can be done with [**imgtool**](https://github.com/arduino/imgtool-packing/releases/latest). You can download and install it directly from the release section.
3938

40-
***Pro tip: imgtool is already installed by the mbed platform and can be found in the `%LOCALAPPDATA%\Arduino15\packages\arduino\tools\imgtool` directory on Windows, in `~/.arduino15/packages/arduino/tools/imgtool` on Linux and in `~/Library/Arduino15/packages/arduino/tools/imgtool` on macOS.***
39+
***`imgtool` is already installed by the mbed platform and can be found in the `%LOCALAPPDATA%\Arduino15\packages\arduino\tools\imgtool` directory on Windows, in `~/.arduino15/packages/arduino/tools/imgtool` on Linux and in `~/Library/Arduino15/packages/arduino/tools/imgtool` on macOS.***
4140

4241
To generate the new keys you can use this command line:
4342
```
4443
imgtool keygen --key my-sign-keyfile.pem -t ecdsa-p256
4544
imgtool keygen --key my-encrypt-keyfile.pem -t ecdsa-p256
4645
```
47-
This command line will generate two private PEM encoded security keys and save them in the current directory with `my-sign-keyfile.pem`and `my-encrypt-keyfile.pem` names. The algorithm used to generate the keys is ECDSA 256bit.
46+
This command line will generate two private PEM encoded security keys and save them in the current directory with `my-sign-keyfile.pem` and `my-encrypt-keyfile.pem` names. The algorithm used to generate the keys is ECDSA 256bit.
4847

49-
Remember to **save the keys to a secure location** and not to lose them.
48+
Remember to **save the keys on a secure location** and not to lose them.
5049

5150
### 2. Upload the Custom Keys to the Board
5251
Once the keys have been generated they have to be uploaded on the Portenta. This procedure has to be done only once, because it's persistent. To extract the public\private key and encode it in to a "C" byte array inside a `.h` header file you can use:
@@ -56,7 +55,7 @@ imgtool getpub -k my-sign-keyfile.pem > ecsda-p256-signing-key.h
5655
```
5756

5857
Now you have to replace the keys inside the Sketch to update the bootloader(**STM32H747_updateBootloader**).
59-
To do so just save the sketch to another location and replace the `ecsda-p256-encrypt-key.h` and `ecsda-p256-signing-key.h` files with the newly generated ones and then [update the bootloader](../por-ard-bl/content.md) again.
58+
To do so just save the sketch to another location and replace the `ecsda-p256-encrypt-key.h` and `ecsda-p256-signing-key.h` files with the newly generated ones and then [update the bootloader](https://docs.arduino.cc/tutorials/portenta-h7/updating-the-bootloader) again.
6059

6160
***NOTE: In case the keys are compromised, this process can be performed again with a new set of keys, but any firmware signed with the previous pair will no longer work.***
6261

0 commit comments

Comments
 (0)